GitLab

This SR was developed and tested in environments where both software and instance where owned by the same unix user. These are fixes for problems discovered when running on a "system level" slapos.

This cannot easily be tested without actually using different users (especially the mistake on the mode of the executable script), but this MR introduce some tests to check that service running in instance does not open files or unix sockets outside of instance. It also introduce a utility method to access the supervisor RPC API, it can be useful if tests needs to start/stop a process or get process PID to inspect this process.

I ran into problems, because proftpd sets PR_SET_DUMPABLE to 0, which disables any possibility of inspecting a running program. See 18e28bbb for details about the chosen approach.

/cc @rafael @Nicolas @luke @Eteri @vpelletier